enshrined/svg-sanitize

Project backingcaution

The package is backed by a personal repository rather than an organization, so the single registry maintainer and contributor concentration warrant some attention. However, current activity from four repository contributors and a fresh release provide meaningful compensation.

Repo bus factorcaution

The leading contributor made 70% of recent commits, which is somewhat concentrated, but three other contributors each remained active during the same period. The concentration is therefore a manageable caution rather than a severe abandonment risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. For a package whose purpose is sanitizing untrusted SVG input, this is a meaningful transparency and assurance gap despite the active test suite.

Security policycaution

The repository has no security policy. That leaves vulnerability-reporting and response expectations undocumented, which matters for a security-focused sanitizer.

Token permissionscaution

Both workflows lack top-level token-permission declarations, although neither requests top-level write permissions. Explicit least-privilege declarations would improve CI transparency and reduce configuration ambiguity.